WO2004029873A1

WO2004029873A1 - Secure electronic unit comprising time management system

Info

Publication number: WO2004029873A1
Application number: PCT/FR2003/002780
Authority: WO
Inventors: Paul Dischamp; Christophe Giraud
Original assignee: Oberthur Card Systems Sa
Priority date: 2002-09-25
Filing date: 2003-09-22
Publication date: 2004-04-08
Also published as: FR2844897A1; FR2844897B1; WO2004029873A8; AU2003282182A8; AU2003282182A1

Abstract

The invention relates to a secure electronic unit (11) comprising a means (18) of measuring the elapsed time between two operations. The invention also comprises means (19) of storing an authorised minimum or maximum duration, which co-operates with the aforementioned time measurement means (18) in order to determine if the elapsed time complies with the authorised duration. The invention is suitable, in particular, for SIM card- or bank card-type microcircuit cards.

Description

SECURE ELECTRONIC ENTITY WITH TIME MANAGEMENT

The invention relates to a secure electronic entity and in particular relates to an improvement made to such an electronic entity so that it can perform time management between two operations and, from the development of '' an indication representative of the elapsed time, check whether the elapsed time meets a minimum or maximum authorized duration between two operations.

In the following, the operations considered are not necessarily of the same nature.

Here we mean time management "in" the card in the sense that this management is independent of any external time measurement system, whether for example a clock signal generator or any other means for measuring the time outside relative to the card. These specific features make it possible to make the electronic entity object of the present invention relatively inviolable.

The invention can be applied to any secure electronic entity, such as, for example, a secure microcircuit card, comprising means allowing it to be coupled at least temporarily to a source of electrical energy for the implementation at least of an operation. The invention can in particular make it possible to determine the time which elapses between two operations, the knowledge of this additional data making it possible to detect an attempt at fraud and, consequently, to further secure the electronic entity. By "operation" is meant very generally any step implemented by the electronic entity in question, whether or not this step involves an exchange of data with the outside of the assembly constituted by the card and its reader, see the card alone.

The security of an electronic entity (for example a microcircuit card such as a bank card or an access control card or the like) can be improved if it is possible to take account of the time which has elapsed between two operations. There are a wide variety of possible attacks against microcircuit cards. Some of these attacks are intended to find the secrets that are kept in the memory of the microcircuit or to modify the normal behavior of the card in order to take advantage of it. For example, DPA (differential power analysis, in English "Differential Power Analysis"), SPA (simple power analysis, in English "Simple Power Analysis"), EA (electromagnetic analysis, in English "ElectroMagnetic Analysis"), DEMA ( differential electromagnetic analysis, in English "Differential ElectroMagnetic Analysis"), or DFA (differential error analysis, in English "Differential Fault Analysis") are well-known names for such attacks, called non-intrusive, because they do not involve the destruction of the card.

To carry out these types of attacks, the card is generally asked to execute parts of algorithms repeatedly. For example, to find secret authentication keys for the card by means of a DPA attack, the card is usually asked to authenticate n times in succession, n being an integer generally greater than 50. This large number of authentications carried out in a very short time is in principle an abnormal use of the card.

However, in known microcircuit cards, the concept of time is most often brought in from the outside (as, conventionally, by an external clock signal), which makes the attacks mentioned above more easily achievable.

The present invention aims to remedy the aforementioned drawbacks, by preventing an "attacker" or a fraudster from abnormally using a secure electronic entity and by integrating, for this purpose, in the electronic entity, the time management between two operations.

The invention thus proposes to compel the electronic entity not to execute more than a certain number of operations in a given time.

To this end, the invention proposes a secure electronic entity, remarkable in that it contains a unit for measuring the time which elapses between two operations, and in that it comprises a storage unit with a minimum duration. or maximum authorized, the storage unit cooperating with the time measurement unit, in order to determine whether this elapsed time respects this authorized duration.

According to the invention, the means for determining the time which elapses between two operations are located in the electronic entity, which makes it possible to increase its security.

Advantageously, the time measurement unit is adapted to provide a measurement of the time that elapses between two operations even when the electronic entity is not supplied by an external energy source.

Advantageously, the time measurement unit is adapted to provide a measurement of the time that elapses between two operations even when the electronic entity is not supplied with electricity.

Advantageously, the time measurement unit is adapted to provide a measurement of the time which passes between two operations independently of any external clock signal. In this sense, the electronic entity is autonomous, both from the point of view of time measurement and from the point of view of power supply.

As a variant, it is of course possible to provide a battery and / or a clock in the electronic entity.

The operations in question can all be of the same nature; for example, they may only be authentication operations. This is however not always the case and the operations can be of various natures.

The time measurement unit can include a means of comparing two dates, a date being, in general, an expression of current time and these two dates being understood here as two instants defined with respect to the same time reference.

The storage unit for the authorized duration advantageously includes a secure entity and can be located inside or outside the electronic entity.

The "operations" mentioned above may include the use of secret data, which may for example be a cryptographic key or a personal code. In a plurality of examples of application of the invention, some of which are detailed below, the authorized duration mentioned above corresponds to a maximum authorized consumption per unit of time.

In a preferred embodiment of the present invention, the secure electronic entity comprises at least one sub-assembly comprising: a capacitive component having a leak through its dielectric space, means making it possible to couple this capacitive component to a source of electrical energy to be charged by the electrical energy source and a means for measuring the residual charge of the capacitive component, this residual charge being at least partly representative of the time which has elapsed after the capacitive component has been decoupled of the electrical power source.

In this case, the capacitive component of the above-mentioned sub-assembly can only be charged when the secure electronic entity is coupled to the source of electrical energy. The latter may be external to the secure electronic entity, but this is not imperative: as a variant, provision may be made to supply the electronic entity with a battery placed in or on it.

The electronic entity may be provided with a switching means for decoupling the capacitive component from the electrical energy source, this event initializing the measurement of time.

More generally, the measurement of time, that is to say the charge variation of the capacitive component, begins as soon as, after being charged, it is electrically isolated from any other circuit and can no longer discharge until 'through its own dielectric space. However, even if, physically, the measured residual charge is related to the time interval between the isolation of the capacitive element and a given measure of its residual charge, a measured time interval (which will be considered normal or abnormal or which can in any case be taken into account to determine whether the use made of the electronic entity is normal or abnormal) can be determined between two measurements, the first measurement in a way determining a reference residual charge. The means for measuring the residual charge of the capacitive component is used when it is desired to know an elapsed time. The capacitive component being charged during an operation, the means for measuring the residual charge is used during such an operation to provide information at least partly representative of the time which has elapsed since the last surgery. Furthermore, the invention also allows the secure electronic entity to continue measuring the time between two operations even after the electronic entity has been temporarily supplied with current and that it is then devoid of any new electrical supply. . The invention therefore does not require the use of a source of electrical energy permanently. The means for measuring the residual charge can be included in the time measurement unit mentioned above.

In the preferred embodiment, the means for measuring the residual charge comprises a field effect transistor whose gate is connected to a terminal of the capacitive component, that is to say to an "armature" of a capacitor . Such a capacity can be achieved in MOS technology and its dielectric space can then be constituted by a silicon oxide. In this case, it is advantageous that the field effect transistor is also produced in MOS technology. The gate of the field effect transistor and the "armature" of the capacitive component MOS are connected and constitute a kind of floating gate which can be connected to a component making it possible to inject charge carriers.

We can also ensure that there is no actual electrical connection with the external environment. The connection of the floating grid can be replaced by a control grid (electrically insulated) which charges the floating grid, for example by tunnel effect or by "hot carriers". This gate makes it possible to make charge carriers pass to the floating gate common to the field effect transistor and to the capacitive component. This technique is well known to manufacturers of EPROM or EEPROM memories. The field effect transistor and the capacitive component can constitute a unit integrated in a microcircuit included in the secure electronic entity or forming part of another microcircuit housed in the same secure electronic entity. During certain operations, when the secure electronic entity is still coupled to an external electrical energy source, the capacitive component is charged to a predetermined value, known or measured and stored, and the means for measuring the residual charge is connected to a terminal of this capacitive component.

At the end of the operation, the means for measuring the residual charge, in particular the field effect transistor, is no longer supplied, but its gate connected to the terminal of the capacitive component is brought to a voltage corresponding to the charge of this one. During the entire period of time between two operations, the capacitive component discharges slowly through its own dielectric space so that the voltage applied to the gate of the field effect transistor gradually decreases.

When the electronic entity is again connected to a source of electrical energy for the implementation of a new operation, an electrical voltage is applied between the drain and the source of the field effect transistor. Thus, an electric current from the drain to the source (or in the opposite direction depending on the case) is generated and can be collected and analyzed.

The value of the electrical current measured depends on the technological parameters of the field effect transistor and on the potential difference between the drain and the source, but also on the voltage between the gate and the substrate. The current therefore depends on the charge carriers accumulated in the floating gate common to the field effect transistor and to the capacitive component. Consequently, this drain current is also representative of the time which has elapsed between the two operations.

The leakage current of such a capacity depends of course on the thickness of its dielectric space but also on any other so-called technological parameter such as the lengths and contact surfaces of the elements of the capacitive component. It is also necessary to take into account the three-dimensional architecture of the contacts of these parts, which can induce phenomena modifying the parameters of the leakage current (for example, modification of the value of the so-called tunnel capacity). The type and quantity of dopants and faults can be modulated to modify the characteristics of the leakage current.

The temperature variations also have an influence, more precisely the average of the heat energy inputs applied to the secure electronic entity between two operations, that is to say during the time that one seeks to determine. In fact, any parameter intrinsic to MOS technology can be a source of modulation of the time measurement process. With regard to the calorific contributions, however, if the dielectric is very thin (less than 5 nanometers), the corresponding sub-assembly is practically insensitive to temperature, but the relatively large leak is such that can only measure relatively short periods of time, on the order of a few minutes or less. Such a high-leakage, temperature-independent sub-assembly can, however, be used for the detection of certain types of fraud. For example, this type of capacitive component can make it possible to detect successive authentication attempts very close in time or data encryption operations which are characteristic of certain so-called DPA attacks mentioned above.

To measure longer times, it is necessary to use a capacitive component having a dielectric space of greater thickness. In this case, the leak is sensitive to temperature variations.

Advantageously, the thickness of the insulating layer of the field effect transistor is notably greater (for example approximately three times greater) than the thickness of the insulating layer of the capacitive component.

As for the thickness of the insulating layer of the capacitive component, it is advantageously between 4 and 10 nanometers.

In order to obtain information that is substantially only representative of the time, it is possible, in an alternative embodiment, to provide at least two sub-assemblies as defined above, operated "in parallel". The two capacitive components sensitive to temperature are defined with different leaks, all other things being equal, that is to say that their dielectric spaces (thickness of the layer of silicon oxide) have different thicknesses. To this end, according to an advantageous arrangement of the invention, the electronic entity defined above is remarkable in that it comprises: at least two aforementioned sub-assemblies each comprising: a capacitive component having a leak through its dielectric space, means making it possible to couple this capacitive component to a source of electrical energy to be charged by this source of electrical energy and a means for measuring the residual charge of the capacitive component, this residual charge being at least partly representative of the time which has elapsed after the capacitive component has been decoupled from the electric power source, these subassemblies comprising capacitive components having different leaks through their respective dielectric spaces, and in that the entity secure electronics also includes: means for processing the measurements of the respective residual charges of these com capacitive layers, to extract from these measurements information that is substantially independent of the calorific contributions applied to the secure electronic entity during the time between two operations. For example, the processing means may include a table of stored time values, this table being addressed by these respective measurements. In other words, each pair of measurements designates a stored time value independent of the temperature and of the temperature variations during the measured period. The electronic entity advantageously includes a memory associated with a microprocessor and part of this memory can be used to store the table of values.

As a variant, the processing means may include calculation software programmed to execute a predetermined function making it possible to calculate the time information, substantially independent of the calorific contributions, as a function of the two aforementioned measurements. In a particular embodiment, the storage unit is adapted to store a security duration, during which a predetermined security process is implemented when the time elapsed between two operations does not respect the aforementioned minimum authorized duration. This further increases the security of the electronic entity. The invention is particularly suitable for applying to microcircuit cards. The secure electronic entity can be a microcircuit card, or include one, or even be of another type, for example, be a PCMCIA card (international architecture of memory cards of personal computers, in English "Personal Computer Memory Card International Architecture "). The invention is also remarkable for its level of integration. Other aspects and advantages of the invention will appear on reading the detailed description which follows of particular embodiments, given by way of nonlimiting examples. The description is made with reference to the accompanying drawings, in which: FIG. 1 is a block diagram representing, in a particular embodiment, a secure electronic entity in accordance with the present invention; - Figure 2 is a block diagram of a microcircuit card to which the invention can be applied, in a particular embodiment; Figure 3 is a block diagram of a sub-assembly that the secure electronic entity can include in a particular embodiment; and - Figure 4 is a block diagram of a variant of the embodiment of Figures 1 and 2.

As shown in FIG. 1, a secure electronic entity 11 in accordance with the present invention contains a unit 18 for measuring the time which passes between two operations. The time measurement unit 18 is independent of any external time measurement system, whether for example a clock signal generator or any other time measurement means located outside. compared to the map.

This unit 18 for measuring the time elapsing between two operations makes it possible to prevent a potential attacker or fraudster from acquiring secrets, such as an encryption key, which are stored in the electronic entity 11, or that the attacker can modify the behavior of the electronic entity 11 in order to profit illegally. For this, in a first example described here without limitation, the secure electronic entity 11 is forced not to execute more than a certain number of authentications, or other functions calling on cryptographic algorithms, in one given time. Admittedly, authorized behavior of the secure electronic entity 11 may involve the execution of several authentications in a given time. However, this number of successive authentications has a limit. Thus, for example, it can be provided that, if the secure electronic entity 11 performs a total number N, to be decided beforehand, of authentications in a time interval less than a minimum authorized duration T _m i _n ι, it is necessary to wait a time T _a "ι before being able to perform the (N + 1) ^th authentication, then again T _a t _t ι minutes before being able to perform the (N + 2) ^th , and so on.

By way of nonlimiting example, one can choose N = 50, T _m i _n1 = 5 minutes and T _att ι = 10 minutes. The sequence of operations is as follows: in case of 50 authentications in less than 5 minutes, for example 3 minutes, is allowed a 51 ^th authentication to the ^13th minute, a 52 ^erπe authentication to the 23 ^th minute, a 53 ^{è e} authentication at the 33 ^th minute, etc.

The secure electronic entity 11 includes for this purpose a unit 19 for storing an authorized duration. It can be either a minimum duration T _m jn, as T _m ι _n ι in the first example described here, or a maximum duration

Tm _a x. The unit 19 for memorizing the authorized duration is advantageously a secure memory of the electronic entity 11, this memory being in particular not accessible from the outside. As a variant, it is possible to envisage locating the unit 19 for storing the authorized duration outside the secure electronic entity 11, in an external secure entity. In the latter case, the value of the authorized duration T _m i _n or T _max is received from the outside, from a so-called "trusted" third party (authorized authority), by the secure electronic entity 11, via a secure protocol (ie implementing cryptographic means) and is stored at least temporarily in a secure area of the electronic entity 11.

In accordance with the present invention, the storage unit 19 cooperates with the time measurement unit 18, with a view to determining whether the time elapsed between the two operations respects the authorized duration T _m j _n or T _max . It is possible to provide in the memory of the secure electronic entity 11 a region (comprising for example a file) containing the date, for example in seconds, from a predetermined initial time reference, of the N last authentications carried out. The initial time reference corresponds to a given instant in the life of the electronic entity such as the end of its personalization, or its first power-up, or even the last operation on which time management was carried out.

Therefore, in the first example described here, before performing a new authentication, it is provided, for example in the application considered implemented by the secure electronic entity 11, to compare the date of the

^Nth authentication with the date of the first authentication. If the difference between the two dates is greater than the minimum authorized duration T _m d _n ι, authentication is carried out normally. On the other hand, if the difference between the two dates is less than the authorized duration T _m i _n ι, provision may be made to start a security process P _s -ι, consisting for example of authorizing only one authentication per tranche of time of T _waited for a safety duration D _s .

In the nonlimiting example given above, one can choose D _s = 2 hours. After the safety time D _{s has} elapsed, the safety process P _s ι stops and the secure electronic entity 11 returns to normal operating mode.

It is preferable to update the memory region (comprising for example a file) containing the data relating to the time before performing the authentication, in order to avoid an attack which could prevent writing to this file.

In a second example described here without _implied limitation, another security process P _s2 consists in including an increasing time difference T _att2 between the operations - for example the authentications. For example, one can choose a time difference T _att2 which follows a geometric progression. In the example given here, this time difference is each time doubled between two operations. Thus, the N first authentications can be carried out in a time Tmin ₂ , then, once the security process P _S 2 is triggered, a time counter is initialized (for example at a value Tatœ = To) which fixes the time of wait T _a " ₂ between two operations, which are authentications here. At each new authentication, the current value T _a " ₂ of this time counter is multiplied by 2, that is to say that the waiting time between the 1 ^st and N ^th operations is worth To and, for all integer i greater than or equal to 0, the waiting time between the (N + i) ^th and (N + i + 1) ^th operations is T _att = 2 ' ^χ T ₀ .

By way of nonlimiting example, one can choose N = 50, T _miri2 = 5 minutes and T ₀ = 1 minute. The sequence of operations is then as follows: in the event of 50 authentications in less than 5 minutes, for example 4 minutes, a

51 ^th authentication to the 5 ^th minute, a 52 ^th authentication to the ^7th minute, 53 ^ee authentication at the 11 minute ^ee, etc.

As in the first example described above, after the safety time D _{s has} elapsed, the security process P _S2 stops if no new authentication has taken place and the secure electronic entity 11 returns to operating mode normal.

In a third example described here without implied limitation, another security process P _S3 consists in blocking the secure electronic entity 11 definitively if too many operations (in this example, authentications), ie a number of operations greater than a maximum authorized number of operations defined beforehand, are carried out in a given time.

In other words, a minimum period imposed between two operations will not have been respected. For example, if N authentications were carried out in a time less than a minimum duration imposed Tmi _n3 , it can be considered that it is an abnormal use of the application implemented by the secure electronic entity 11 and the electronic entity 11 is then forced to be permanently put out of service. This state can be obtained for example by erasing all the stored data.

By way of nonlimiting example, one can choose N = 50 and T _min3 = 5 minutes. In this case, the secure electronic entity 11 crashes if 50 authentications have been carried out in less than 5 minutes. The security processes P _s can be combined _. and P _S 3-

FIG. 2 illustrates a secure electronic entity 11 in accordance with the present invention, in a particular embodiment where this entity is a microcircuit card. The secure electronic entity 11 includes a unit 12 enabling it to be coupled to an external electrical energy source 16.

In the particular embodiment shown, the secure electronic entity 11 includes metal connection pads which can be connected to a unit forming a card reader. Two of these connection pads 13a, 13b are reserved for the electrical supply of the microcircuit, the source of electrical energy being housed in a server or other device to which the secure electronic entity is temporarily connected.

These connection pads can be replaced by an antenna housed in the thickness of the card and capable of supplying the microcircuit with the electrical energy necessary for its supply while ensuring the bidirectional transmission of radiofrequency signals allowing the exchange of information. This is called contactless technology.

The microcircuit comprises a microprocessor 14 conventionally associated with a memory 15.

In a particular embodiment, the secure electronic entity 11 includes at least one sub-assembly 17 (or is associated with such a sub-assembly) responsible for measuring time.

The sub-assembly 17, which is shown in more detail in FIG. 3, is therefore housed in the secure electronic entity 11. It can be part of the microcircuit and be produced in the same integration technology as the latter. In the example, this sub-assembly 17 is not connected to any internal electrical energy source. It can therefore only be powered when the secure electronic entity 11 is effectively coupled to a server or to a card reader, comprising such a source of electrical energy. However, if the secure electronic entity 11 must be permanently supplied, the sub-assembly 17 which is responsible for measuring the time may or may not be supplied via a switching module making it possible to couple the secure electronic entity 11 to the source of electrical energy or isolate it. Such a module switching is for example an integral part of the microprocessor 14, or constituted by switching elements managed by the microprocessor 14.

The subassembly 17 comprises a capacitive component 20 having a leak through its dielectric space 24 and a unit 22 for measuring the residual charge of this component 20.

This residual charge is at least partly representative of the time elapsed after the capacitive component 20 has been decoupled from the source of electrical energy, that is to say in the example given here, between two operations. The capacitive component 20 is charged by the external electrical energy source during an operation, either by direct connection, as in the example described, or by any other means which can cause the grid to be charged. The tunnel effect is a method of loading the grid without direct connection. In the example, the load of the capacitive component 20 is controlled by the microprocessor 14.

In the example, the capacitive component 20 is a capacitor produced using MOS technology. The dielectric space 24 of this capacity consists of a layer of silicon oxide deposited on the surface of a substrate 26 constituting one of the reinforcements of the capacitor. This substrate 26 is here connected to ground, that is to say to one of the supply terminals of the external electrical energy source, when the latter is connected to the card. The other armature of the capacitor is a conductive deposit 28a applied to the other face of the layer of silicon oxide.

Furthermore, the previously mentioned measurement unit 22 essentially comprises a field effect transistor 30, here produced using MOS technology, like the capacitance. The gate of the transistor 30 is connected to a terminal of the capacitive component 20. In the example, the gate is a conductive deposit 28b of the same kind as the conductive deposit 28a which, as indicated above, constitutes one of the reinforcements of the capacitive component 20. The two conductive deposits 28a and 28b are connected to each other or constitute one and the same conductive deposit. A connection 32 connected to the microprocessor 14 makes it possible to apply a voltage to these two deposits 28a and 28b, for a short time interval required to charge the capacitive component 20. The application of this voltage is controlled by the microprocessor 14. More generally, the connection 32 makes it possible to charge the capacitive component 20 at a chosen time, under the command of the microprocessor 14 and it is from the moment when this load connection is cut by the microprocessor 14 (or when the secure electronic entity 11 is decoupled as a whole from any source of electrical power) that the discharge of the capacitive component 20 through its dielectric space 24 begins, this loss of electrical charge being representative of the time elapsed. The measurement of time implies the momentary conduction of the transistor 30, which supposes the presence of a source of electrical energy applied between drain and source.

The MOS technology field effect transistor 30 comprises, in addition to the gate, a gate dielectric space 34 separating the latter from a substrate 36 in which a drain region 38 and a source region 39 are defined.

The gate dielectric space 34 is constituted by an insulating layer of silicon oxide. The source connection 40 applied to the source region 39 is connected to the ground and to the substrate 36. The drain connection 41 is connected to a drain current measurement circuit which includes a resistor 45 at the terminals of which are connected the two inputs of a differential amplifier 46. The voltage delivered to the output of this amplifier is therefore proportional to the drain current.

The gate 28b is put in the floating position during the time which elapses between two couplings or connections to an external electrical energy source, that is to say on the occasion of two successive operations. In other words, no voltage is applied to the grid during this time interval. On the other hand, since the grid is connected to an armature of the capacitive component 20, the grid voltage during this time interval is equal to a voltage which develops between the terminals of the capacitive component 20 and which results from an initial charge of that this carried out under the control of the microprocessor 14 during the last operation.

The thickness of the insulating layer of the transistor 30 is notably greater than that of the capacitive component 20. By way of nonlimiting example, the thickness of the insulating layer of the transistor 30 can be approximately three times greater than the thickness of the insulating layer of the capacitive component 20. Depending on the application envisaged, the thickness of the insulating layer of the capacitive component 20 is between 4 and 10 nanometers, approximately.

When the capacitive component 20 is charged by the external electrical power source and after the load connection has been cut under the control of the microprocessor 14, the voltage across the terminals of the capacitive component 20 slowly decreases as the latter gradually discharges through its own dielectric space 24. The discharge through the dielectric space 34 of the field effect transistor 30 is negligible given the thickness of the latter.

By way of nonlimiting example, if, for a given thickness of dielectric space, the grid and the armature of the capacitive component 20 are charged at 6 volts at an instant t = 0, the time associated with a pressure drop of 1 volt, that is to say a lowering of the voltage to a value of 5 volts, is of the order of 24 seconds for a thickness of 8 nanometers.

For different thicknesses, we can draw up the following table:

Accuracy depends on error made on reading the drain current

(About 0.1%). Thus, to be able to measure times of the order of a week, a layer of dielectric space of the order of 9 nanometers can be provided.

FIG. 3 shows a particular architecture which uses a direct connection to the floating gate (28a, 28b) in order to apply an electrical potential to it and therefore to pass charges through it. It is also possible to carry out an indirect charge, as mentioned previously, by means of a control grid replacing the direct connection, according to the technology used for the manufacture of EPROM or EEPROM cells. The variant of FIG. 4 provides three sub-assemblies 17A, 17B, 17C, each associated with the microprocessor 14. The sub-assemblies 17A and 17B comprise capacitive components having relatively small leaks to allow relatively long time measurements. However, these capacitive components are generally sensitive to temperature variations. The third sub-assembly 17C comprises a capacitive component having a very small dielectric space, less than 5 nanometers. It is therefore insensitive to temperature variations. The two capacitive components of the subassemblies 17A, 17B have different leaks through their respective dielectric spaces.

In addition, the secure electronic entity comprises a module for processing the measurements of the respective residual charges present in the capacitive components of the first two sub-assemblies 17A, 17B. This processing module is adapted to extract from these measurements information representative of the times and substantially independent of the heat inputs applied to the secure electronic entity during the time elapsed between two successive operations mentioned above.

In the example, this processing module merges with the microprocessor 14 and the memory 15. In particular, a space in the memory 15 is reserved for storing an array T with double entry of time values and this array is addressed by the two respective measurements from subsets 17A and 17B. In other words, a part of the memory includes a set of time values and each value corresponds to a pair of measurements resulting from the reading of the drain current of each of the two transistors of the temperature sensitive subsets 17A, 17B.

Thus, during an operation, for example towards the end thereof, the two capacitive components are charged, at a predetermined voltage value, by the external electrical energy source, via the microprocessor 14. When the microcircuit card is decoupled from the server or card reader or other entity, the two capacitive components remain charged but begin to discharge through their own respective dielectric spaces and, as time passes, without the microcircuit card is used, the residual charge of each of the capacitive components decreases but differently in one or the other, due to the different leaks determined by construction.

When the card is again coupled to an external electrical energy source during a new operation, the residual charges of the two capacitive components are representative of the same time interval that we are trying to determine but differ due to the temperature variations that may have occurred during this entire period of time.

When the card is reused, the two field effect transistors of these two sub-assemblies are supplied and the values of the drain currents are read and processed by the microcircuit. For each pair of drain current values, the microcircuit will seek in memory, in the table T mentioned above, the corresponding time value. This time value is then compared to the minimum or maximum authorized duration and the operation is only authorized if the elapsed time is, depending on the application considered, greater than the minimum authorized duration, or less than the maximum authorized duration, respectively.

As a variant, this time value can be compared with a value available in the server or card reader or other entity, preferably secure. In addition, the operation may only be authorized if not only the elapsed time respects the minimum or maximum authorized duration, but also if the time value obtained in the card (for example the time value stored in the table T) is compatible with the value available in the server or card reader or other entity, that is to say if in addition these two values coincide or are relatively close, according to a tolerance chosen beforehand.

It is not necessary to memorize the table T. For example, the processing module, that is to say essentially the microprocessor 14, may include a part of software for calculating a predetermined function making it possible to determine said information. appreciably independent of the calorific contributions according to the two measurements.

The third sub-assembly 17C comprises, as described above, an extremely thin dielectric space making it insensitive to temperature variations. This subset can be used, under the control of the microprocessor 14, for detecting repeated authentication attempts which for example often occur during a DPA attack.

Other variations are possible. In particular, if we want to simplify the sub-assembly 17, we can consider eliminating the capacitive component 20 as such, because the field effect transistor 30 can itself be considered as a capacitive component with the gate 28b and the substrate 36 as reinforcements, the latter being separated by the dielectric space 34. In this case, it can be considered that the capacitive component and the measurement unit are combined. In the three examples described above including the implementation of security processes P _s -ι, P _S2 and P _S3 , there are several possibilities for keeping the time indication between operations.

A first possibility is to load the cell which measures time once, when the card is put into service. When an operation (for example an authentication) is carried out, the state of charge of the cell at an instant t1 is memorized (for example recorded in a file of a secure region of the memory of the card). When a second operation of the same nature (in the example, a second authentication) is carried out, the state of charge of the cell at time t2 is memorized (in the example, recorded in the file), and so on, so that, when an N ^th operation of the same kind (in the example, with N = 50, a 50 ^th authentication) is carried out, the state of charge of the cell at time tN is stored (in the example, t50 is written to the file).

To determine the time elapsed between the 1 ^st and the N ^th operations, it suffices to compare the state of the cell charge at t1 with the state of the cell charge at tN. By subtracting the values of the charges and by means of a correspondence table between charges and elapsed time (which can be produced from a table similar to the table T described above), the desired elapsed time is obtained. In fact, by "load" of the cell, we mean here the physical value linked to this cell, such as the voltage across its terminals. However, for a simpler use of this quantity, it is possible to provide in the card a system (such as for example the correspondence table mentioned above) allowing to associate this physical value with a logical quantity more directly representative of time.

Other possibilities consist in recharging the cell at regular time intervals, or each time the secure electronic entity is powered up.

Advantageously, a single capacitive component is used for a plurality of operations. On each execution of a given operation (for example, resetting the card to zero), the time since the last recharging of the capacitive component is measured, then the capacitive component is recharged. The times thus measured are accumulated in a location in the card's non-volatile memory.

This memory location thus stores the time elapsed since the first charge of the capacitive component (the first charge taking place, for example, when the card is first powered up) and makes it possible to know the time elapsed at any time for any type of 'surgery.

This solution has the advantage of using a single capacitive component having a relatively small oxide thickness, which gives greater precision in time measurement, compared with the case of a single component for the entire lifetime. from the menu. The time which elapses between the instant of measurement of the charge of the capacitive component and the moment of its recharging is sometimes not negligible, in particular if the card is withdrawn from the reader before recharging. To take this time interval into account, a second component can be used, the function of which will be to take over from the first during this time interval. It is also possible to use capacitive components of different precision in order to improve the precision of the measurement: one will choose, from among several measurements, that obtained from the most precise component which is not discharged.

Yet another possibility consists in reloading the cell each time an operation of a given type is executed (for example, at each authentication), after having measured the time elapsed since the previous operation of the same type. An advantage of this possibility is that components suitable for the operation to be checked can be provided to improve the precision of time measurement; in the time measurement cell, in particular with regard to the oxide thickness, it has been seen from the table given above that the choice of the oxide thickness influences the accuracy of the measurement.

This possibility of reloading the cell on each execution of an operation of a given type is appropriate when a time measurement cell is provided for each application considered in the card. In fact, knowing that the cell is recharged with each new operation of the same nature, each application using the time management system in accordance with the present invention uses the time measurement cell associated with it. In this hypothesis, for the application considered, the difference between the maximum cell load and the state of charge at the time of the new operation (in the example, the new authentication) is stored (in the example, in a file in a secure region of the card memory). This difference represents the time between the two operations. To obtain the time elapsed between N operations, it then suffices to add the (N-1) values of the previously stored differences. Other variants, within the reach of those skilled in the art, are possible. Another example of application of a secure electronic entity in accordance with the present invention, in which the electronic entity is also a microcircuit card, consists, in the banking field, of introducing additional security for purchases made by means of the map.

For example, we can plan to trigger a connection with the server of the bank concerned when many purchases of small amounts have been made (generally without connection to the bank) in a given time interval (for example ten "small purchases" in one o'clock). The choice of this time interval, i.e. the duration authorized within the meaning of the present invention, may depend on the state of the bank account of the card holder at the time when the card made its last connection with the bank.

To do this, in a particular embodiment, the card contains a file with the date and the amount of purchases. The date is stored, for example, in the form of the state of charge in the time measurement cell, described above in conjunction with FIGS. 2 to 4, or else stored in the form of a more directly representative logic value time, in a table of correspondence between charges and elapsed time as indicated above. The operations here consist of any of the recurring treatments carried out by the card during a purchase.

With each new purchase, the application implemented by the card will look for all the operations carried out after the expiration of a time Ut and calculate the total number of "small purchases" made by the user of the card. If this number is less than a predefined threshold authorized in the time interval considered, the new purchase is accepted; otherwise, the card communicates with the bank that issued it, for verification purposes. Thus, in accordance with the invention, the use of the time counter inside the card makes it possible to improve security since the counting of time is difficult to falsify.

An example of application of a secure electronic entity in accordance with the present invention, in the field of mobile telephony, where the electronic entity is a card of the SIM type (subscriber identification module, in English "Subscriber Identity Module ") or similar, and where the operations take place without data exchange with the exterior of the assembly constituted by the card and the mobile telephone terminal, consists in limiting the number, per unit of time, of attempts to 'authentication of the subscriber by entering his personal identification code (PIN code, in English "Personal Identification Code").

When the user enters his PIN code on the keypad of the mobile phone, the latter communicates it to the SIM card. The card verifies the PIN code in order to authenticate the subscriber and give him access to wireless communication services. If the PIN code entered is incorrect, the user is authorized to make a maximum number of attempts (typically three) before the card is blocked. The operations considered here are any of the recurring treatments carried out by the card during the entry of the PIN code by the user.

According to the invention, the card is not blocked after three presentations of an incorrect PIN code, but access to wireless communication services will be subject to a certain waiting time if for example the number of incorrect PIN code entries exceeds a maximum number per time unit. We can by example implement a safety process of type P _s2 as described above, with N = 3, T ₀ = Tmj _n2 = 2 hours and D _s = 12 hours.

Yet another example of application of a secure electronic entity in accordance with the present invention, also in the field of mobile telephony, where the electronic entity is also a card of the SIM or similar type, consists in limiting the communication time per time unit U _t of a mobile phone associated with this SIM card.

For example, one can choose to prevent a user of the telephone from making calls exceeding a certain total duration D _t per time unit Ut, the time unit Ut defined in advance can be, as in the example of banking application given previously, a day, a week or any other period of time. By way of illustration, in no way limiting, it is possible to choose D _t = 1 hour and Ut = 1 day, which amounts to limiting the communication time to a maximum of one hour per day. To do this, in a particular embodiment, the card contains a file, for example daily, with the duration of all the telephone calls of the day. For each communication, the duration was obtained by subtracting the communication end time h1 from the communication start time hO. These start and end times of communication are memorized, similar to the dates in the example of banking application given previously, for example, in the form of the state of charge in the time measurement cell, described more top in conjunction with Figures 2 to 4, or stored in the form of a logic value more directly representative of time, in a correspondence table between charges and elapsed time as indicated above. The operations here consist of any of the recurring processing operations carried out by the card during an outgoing telephone call.

With each new outgoing call, the application implemented by the card will look for all the operations carried out since the time U _{t has elapsed} and add up the durations of calls made by the user of the card. If the result of this addition is less than the maximum total duration authorized in the time interval considered (in the example, 1 h per day), the transmission of the new communication is accepted; otherwise, it is refused. In the examples of application to bank cards and mobile telephones which have just been detailed, as in the three examples described above including the implementation of security processes P _s ι, P _s2 and P _S 3, there are has several possibilities for managing the time measurement cell in the secure electronic entity 11, namely, for example, a single charge at the start of the life of the card, or a recharging of the cell at each reading of the state of charge in the cell, or recharging of the cell from time to time, with accumulation of the measured times, as described above.

An additional example of application of a secure electronic entity in accordance with the present invention, in which the electronic entity is a SIM card or the like, consists, in the field of mobile telephony, of monitoring and limiting the expected response time after issuing a request by the card.

Thus, one can choose to cancel an operation in progress, by introducing a time delay (in English "time-ouf"), if no response is received during a given period of time.

For example, in a particular embodiment, if the SIM card has not received, after a given time interval has elapsed, confirmation that a short message of the SMS type (short message service, in English "Short Message Service ") sent by the card has been received, for example in the absence of an acknowledgment of receipt, the card can automatically repeat the sending of the short message and / or inform the terminal user of mobile telephony cooperating with the SIM card.

When the short message is sent, the corresponding instant tO (or the state of charge of the time measurement cell at instant tO) is stored in the card (for example in a file of a secure region of card memory).

At any time, it is possible to monitor the time elapsed since the sending of the aforementioned short message, by making the difference between the current instant t (or the current charge of the time measurement cell) and the instant tO ( or the state of charge of the time measurement cell at time t0). These moments are memorized, similar to the dates or times in the examples of application to bank cards and given mobile phones. previously, for example, in the form of the state of charge in the time measurement cell, described above in conjunction with FIGS. 2 to 4, or else stored in the form of a logic value more directly representative of time, in a correspondence table between charges and elapsed time as indicated above. The pair of operations consisting of, on the one hand, any of the recurring processing operations carried out by the card during the sending of a short message and, on the other hand, any of the recurring processing operations carried out by the card during the reception of an acknowledgment of receipt, here corresponds to the two operations considered for the measurement of the time elapsed between them.

If the difference between the current instant t and the instant t0 is greater than the maximum authorized period of time (typically, of the order of 1 to 10 minutes), in other words, if the difference in charge of the measurement cell of the time between instants tO and t exceeds a maximum authorized charge difference value, and no acknowledgment of receipt has been received, it can be considered that there has been an error or anomaly in the sending of the short message . It should be noted that between the different moments when the application implemented by the secure electronic entity 11 verifies the elapsed time (that is to say the unloading of the time measurement cell from the instant t0 ), the operating system of the card microcircuit can perform other operations, ie the card is not blocked while waiting for the acknowledgment of receipt or when checking the elapsed time (or unloading past the time measurement cell).

A variant of this example application is suitable for purchases made via mobile phones. During the bank transaction which takes place for a purchase, if a receipt has not been obtained by the card within a given maximum period of time, the transaction is not validated. The characteristics described above in relation to the example of application to the emission of a request by the card and the wait for an acknowledgment of return apply mutatis mutandis to this variant. In addition, for these application examples, as in the examples of application to bank cards and mobile phones detailed previously and in the three examples described above including the implementation of security processes P _{s1 l} P _s2 and P _s3 , the various possibilities of management of the time measurement cell in the secure electronic entity 11, detailed above (namely, in particular, a single charge when the card is put into service or a recharging of the time measurement cell at each reading of the state of charge, or a recharging of the cell from time to time, with accumulation of the measured times) also occur. In the particular embodiment illustrated in FIG. 1, the safety duration D _s is memorized in the unit 19 for memorizing the authorized duration.

Claims

1. Secure electronic entity (11), characterized in that it contains a means (18) for measuring the time which passes between two operations, and in that it comprises a means (19) for memorizing a minimum or maximum authorized duration, the storage means (19) cooperating with the time measurement means (18), with a view to determining whether said elapsed time respects said authorized duration.

2. secure electronic entity (11) according to claim 1, characterized in that the time measuring means (18) is adapted to provide a measurement of the time which elapses between two operations when the electronic entity (11) n is not powered by an external energy source.

3. secure electronic entity (11) according to claim 1, characterized in that the time measuring means (18) is adapted to provide a measurement of the time which elapses between two operations when the electronic entity (11) n is not electrically powered.

4. Secure electronic entity (11) according to claim 1, 2 or 3, characterized in that the time measuring means (18) is adapted to provide a measurement of the time which elapses between two operations independently of any signal d outdoor clock.

5. Secure electronic entity (11) according to any one of the preceding claims, characterized in that said operations are of the same nature.

6. Secure electronic entity (11) according to any one of the preceding claims, characterized in that the means (18) for measuring time comprises means for comparing two dates.

7. Secure electronic entity (11) according to any one of the preceding claims, characterized in that the means (19) for storing the authorized duration comprises a secure entity and is located in or out of said electronic entity (11).

8. Secure electronic entity (11) according to any one of the preceding claims, characterized in that said operations include the use of secret data.

9. Secure electronic entity (11) according to any one of the preceding claims, characterized in that said authorized duration corresponds to a maximum authorized consumption per unit of time.

10. Secure electronic entity (11) according to any one of the preceding claims, characterized in that it comprises at least one sub-assembly (17) comprising: a capacitive component (20) having a leak through its dielectric space means for coupling said capacitive component to a source of electrical energy to be charged by said source of electrical energy and means (22) for measuring the residual charge of the capacitive component (20), said residual charge being at less partially representative of the time that has elapsed after the capacitive component (20) has been decoupled from the source of electrical energy.

11. Secure electronic entity (11) according to the preceding claim, characterized in that it comprises a switching means for decoupling said capacitive component (20) from said source of electrical energy.

12. Secure electronic entity (11) according to claim 10 or 11, characterized in that said means (22) for measuring the residual charge is included in said means (18) for measuring time.

13. Secure electronic entity (11) according to claim 10, 11 or 12, characterized in that the capacitive component (20) is a capacitor produced according to MOS technology and whose dielectric space is constituted by a silicon oxide.

14. Secure electronic entity (11) according to any one of claims 10 to 13, characterized in that the means (22) for measuring the residual charge comprises a field effect transistor (30) having an insulating layer (34 ), in that the capacitive component (20) comprises an insulating layer (24) and in that the thickness of the insulating layer (34) of the field effect transistor (30) is significantly greater than the thickness of the insulating layer (24) of the capacitive component (20).

15. Secure electronic entity (11) according to the preceding claim, characterized in that the thickness of the insulating layer (24) of the capacitive component (20) is between 4 and 10 nanometers.

16. Secure electronic entity (11) according to claim 13, 14 or 15, characterized in that it comprises: at least two sub-assemblies (17A, 17B) each comprising: a capacitive component having a leak through its space dielectric, means for coupling said capacitive component to a source of electrical energy to be charged by said source of electrical energy and means for measuring the residual charge of the capacitive component, said residual charge being at least partially representative of the time which has elapsed after the capacitive component has been decoupled from the electric power source, said subassemblies (17A, 17B) comprising capacitive components having different leaks through their respective dielectric spaces, and in that that said secure electronic entity (11) further comprises: means (14, 15, T) for processing measurements of residual charges compliance ives of said capacitive components, for extracting from said measurements information that is substantially independent of the calorific contributions applied to said entity (11) during the time elapsed between two operations.

17. Secure electronic entity (11) according to the preceding claim, characterized in that said processing means (14, 15, T) comprise software for calculating a predetermined function for determining said information substantially independent of the calorific contributions as a function of said measures.

18. Secure electronic entity (11) according to any one of the preceding claims, characterized in that said storage means (19) is adapted to store a safety duration (D _s ), during which a process of implementation is implemented. safety (P _s -ι, P _S2 ) when the time between two operations does not respect the minimum authorized duration.

19. Secure electronic entity (11) according to any one of the preceding claims, characterized in that it is a microcircuit card.